A Risk Management Approach to Data Preservation Ricardo Vieira* (rjcv@ist.utl.pt)
Digital Preservation Digital Preservation (DP) aims at maintaining valuable digital objects accessible over long periods of time» Problem initially triggered by memory institutions where DP is a main concern» Nowadays, widely present as a generalized concern of organizations» How to address it?
Risk Management Overview Risk Management defines prevention and control mechanisms to address the risk attached to specific activities and valuable assets
Digital Preservation as a Risk Management Activity The goal of DP is to protect digital information against several threats that can affect their proper use and interpretation
Risk Management Approach to Data Preservation
Establish the Context (1/2)
Establish the Context (2/2) Identify strategic objects and define criteria to determine which consequences are acceptable to the specific context. Identify Stakeholders Identify the context (Organisational, Technical and Legal)
Context Model The context model is represented as a set of ontologies Ontologies formalize knowledge representation Information can be extracted from ontologies through querying and processing (e.g. reasoning, logical inference) DIO (ArchiMate) DIO-DSO1 Transformation Map DSO-1 DIO-DSO2 Transformation Map DSO-2
Risk Assessment
Risk Identification Identify. Assets Vulnerabilities Threats Risks
Risk-DL Domain Language (1/2) Concepts mapped to ISO 31000 Concepts formalized using the relational model Risk-DL to represente concepts Interoperability Sharing, discovery, reuse Alignment between risks and organization artifacts Reduce inconsistencies (formalization of risks) Open specification -> support human-machine and machine-machine communication XML properties: Portability Extensibility Etc.
Risk-DL Domain Language (2/2)
Risk Analysis (1/2) Impact Likelihood Risk Level
Risk Analysis (2/2)
Scenario Evaluation
Risk Evaluation Based on the outcome of risk analysis, decided which risks need treatment and the priority for treatment implementation Compare level of risk with initial criteria Scenario evaluation: CCCCC = LLLLLLLLLL RRRR i DP mitigates the risk level for 19 risks Costs without DP: 6,316,520 /year Costs with DP: 909,720 /year Risk cost reduction of 5,406,800 /year (=86%) i IIIIII RRRR i
Risk Treatment 18 timbusproject.net 2011 14 November 2013
Conclusions Using risk management we are able to leverage the digital preservation problem Better understanding of the problem Better understanding of the solution This is valid to other concerns!!! Same approach is being applied to Data Management in e-science project Ferreira, F., Coimbra, M., Vieira, R., Proença, D., Freitas, A., Russo, L., Borbinha, J., Risk Aware Data Management in Metagenomics, 5th INForum (INForum 2013), Évora, Portugal, September 5-6, 2013
Ricardo Vieira rjcv@ist.utl.pt